Despite everything, Google still knows my IP address

Discussion in 'BlackHat Lounge' started by UltraMysterious, Nov 12, 2017.

Thread Status:
Not open for further replies.
  1. UltraMysterious

    UltraMysterious Newbie

    Joined:
    Nov 11, 2017
    Messages:
    35
    Likes Received:
    9
    Gender:
    Male
    Hi

    I've been researching for hours and have tried everything I can to trick google into thinking my requests are coming from a different IP address. This works for some sites, but not google. I'm using the WinForms Webbrowser control which uses IE.

    I don't want to use a VPN or proxy, so I've tried:

    1) Sending the following headers using a randomly-generated, valid IP address for all but user-agent:
    Code:
    User-Agent // randomly picked from a list
    Forwarded
    X-Forwarded-For
    Client-IP
    Via
    Proxy-Connection
    Xroxy-Connection
    X-Proxy-ID
    X-Forwarded-For-IP
    X-Forwarded
    Forwarded-For
    X-Coming-From
    Coming-From
    X-Real-IP
    True-Client-IP
    2) Changing web browser viewport size
    3) Clearing IE cookies
    4) Using a program to view LSO files ... none found
    5) Not having Chrome running
    6) Ending all Google-related tasks in task scheduler
    7) Disabling Javascript in IE
    8) I've made sure WebRTC is not leaking my IP.

    The only other thing I haven't tried is spoofing my MAC address, I was told google wouldn't worry about that unless it involves adsense or something of the sort.

    Any assistance would be greatly appreciated
     
    Last edited: Nov 12, 2017
  2. RightFootFanatic

    RightFootFanatic Regular Member

    Joined:
    May 31, 2015
    Messages:
    441
    Likes Received:
    244
    Occupation:
    DevOps
    Location:
    Whimsyshire
    I doubt that switching your ip in the http header will effect the ip your network device sends while doing the tcp/ip handshake.
    you may want to use a proxy or vpn.
     
    • Thanks Thanks x 1
  3. Gr33nArrow

    Gr33nArrow Newbie

    Joined:
    Nov 8, 2017
    Messages:
    24
    Likes Received:
    5
    Gender:
    Male
    spoofing MAC address also pointless.. vpn/proxy is the only way
     
    • Thanks Thanks x 1
  4. frzs90

    frzs90 Registered Member

    Joined:
    Oct 10, 2016
    Messages:
    69
    Likes Received:
    27
    There wouldn't be so much proxy services if you could hide your IP just by changing some request headers :)
    Servers have to know your real IP to send the response to you (or your proxy IP, which forwards it to you).

    Edit:
    I see you already posted this question twice, so I'm also replying to you other thread:
    You don't have to and you can't "tell" your IP.
    Servers see where the request comes from.
     
    Last edited: Nov 14, 2017
  5. Asif WILSON Khan

    Asif WILSON Khan OG Blue Tick Exec VIP Jr. VIP

    Joined:
    Nov 10, 2012
    Messages:
    14,031
    Likes Received:
    38,812
    Gender:
    Male
    Occupation:
    Fun Lovin' Criminal
    Location:
    London
    Home Page:
    OP, you need a proxy, a VPN or use a VPS.

    Google (and every other site not run by clowns) knows all about IP Address Spoofing.
     
    • Thanks Thanks x 1
  6. bigot

    bigot Registered Member

    Joined:
    May 9, 2017
    Messages:
    76
    Likes Received:
    37
    Gender:
    Male
    Occupation:
    Programmer
    Location:
    Canada
    (facepalm) You can't "fake" your IP address.

    When you request a page on a website, the server knows what IP address requested it. The server sends the requested page to the IP that requested it.

    Same concept applies to proxies. However, instead of requesting the page directly, you tell the proxy "go get this page". The proxy requests the page from the website; as stated above, the server knows the IP address of the requester (proxy in this case), and sends the page to that IP address. The proxy server then takes that page and sends it back to you.

    Use a proxy. There are loads of free ones you can use for testing, and good paid ones if you make something that's worth it.



    Also I should add: If you change/spoof your MAC address and release/renew your DHCP lease, you will actually get a new IP address. Do this enough times and your ISP will give you a phone call lol.
     
    • Thanks Thanks x 2
  7. UltraMysterious

    UltraMysterious Newbie

    Joined:
    Nov 11, 2017
    Messages:
    35
    Likes Received:
    9
    Gender:
    Male
    I work for the ISP though ;)
     
  8. ahmadsoe

    ahmadsoe Registered Member

    Joined:
    Jun 20, 2011
    Messages:
    69
    Likes Received:
    24
    Gender:
    Male
    Occupation:
    Brogrammer
    Location:
    Jakarta
    Also dont forget to change your DNS server, any website can guess where you are from DNS.

    Try to visit ipleak.net to see what kind of information that any site (including google) can see when you visit them.
     
    • Thanks Thanks x 2
  9. dr_0x

    dr_0x Jr. VIP Jr. VIP

    Joined:
    May 9, 2010
    Messages:
    307
    Likes Received:
    256
    Home Page:
    Sounds like your missing some fundamental technical knowledge about networking and the how the internet works.

    You're IP can't be spoofed if you are making a full TCP connection. So any web requests are going to use your real IP, there would be no way for you to receive an answer from the web server if you spoofed he source ip address of the packets you are sending.

    I suggest you look into a VPN or using TOR or something.
     
    • Thanks Thanks x 1
  10. Panther28

    Panther28 Jr. VIP Jr. VIP

    Joined:
    May 2, 2010
    Messages:
    3,119
    Likes Received:
    4,105
    Occupation:
    Internet.
    Location:
    Internet.
    Home Page:
    Google can't track your mac address, this is only available on the network layer.

    What are you doing to prove google knows your real ip? Are you just doing a "what is my ip address" in google,
    or are you registering accounts that keep getting banned?
     
  11. UltraMysterious

    UltraMysterious Newbie

    Joined:
    Nov 11, 2017
    Messages:
    35
    Likes Received:
    9
    Gender:
    Male
    Just checking my IP on other sites, if they do, google must.
     
  12. Panther28

    Panther28 Jr. VIP Jr. VIP

    Joined:
    May 2, 2010
    Messages:
    3,119
    Likes Received:
    4,105
    Occupation:
    Internet.
    Location:
    Internet.
    Home Page:
    Then your webRTC isn't working. I test my firefox with proxys, and webRTC disabled, and it works fine on google or other sites, but if I don't have it disabled, they see the real IP.
     
  13. UltraMysterious

    UltraMysterious Newbie

    Joined:
    Nov 11, 2017
    Messages:
    35
    Likes Received:
    9
    Gender:
    Male
    WebRTC isn't leaking my local IP. The original discussion didn't involve proxies, I was trying to see if it was possible to trick a site into thinking you're coming from a different public IP without the use of proxies or anything of that sort.
     
    • Thanks Thanks x 1
  14. SensualTyrannosaurus

    SensualTyrannosaurus Jr. VIP Jr. VIP

    Joined:
    Mar 19, 2015
    Messages:
    1,016
    Likes Received:
    1,763
    Occupation:
    Water Heater Troll (Couldn't find a bridge)
    Location:
    Basement
    Until you figure out how to use a proxy, maybe have your name changed to "somewhatbutnotreallymysterious"
     
    • Thanks Thanks x 3
  15. YesAndNo

    YesAndNo BANNED BANNED

    Joined:
    Nov 20, 2017
    Messages:
    25
    Likes Received:
    33
    Gender:
    Male
    @SensualTyrannosaurus I think since @UltraMysterious learned how TCP handshaking works in 1 day, and possesses a "strong development background" that she is trying to show to her "very experienced and intelligent programmers" and us how she tricked google into believing she has a different IP through a web exploit.

    Her "never give up" attitude and her sheer cleverness will soon reveal us on her next post how her ultra mysterious skills have fooled google's system into believing how she possess a different ip without doing a tcp handshake.

    I believe that is why she chose that name as her username.

    Do you believe so? Yes or No?


     
  16. RightFootFanatic

    RightFootFanatic Regular Member

    Joined:
    May 31, 2015
    Messages:
    441
    Likes Received:
    244
    Occupation:
    DevOps
    Location:
    Whimsyshire
    First Level?

    Please read through the OSI model and the according RFCs
     
  17. selembar

    selembar Junior Member

    Joined:
    Sep 10, 2017
    Messages:
    131
    Likes Received:
    53
    Occupation:
    quit BS'ing about their algo
    Location:
    unless you work on Big G
    "use vpn/proxies..." > invalid.

    "your isp blah.. blah.." > invalid.

    "how are you sure that google knows..." > invalid.

    A bit OOT, but how can I post on BHW using my account but without anyone know it was posted using my account?
     
  18. YesAndNo

    YesAndNo BANNED BANNED

    Joined:
    Nov 20, 2017
    Messages:
    25
    Likes Received:
    33
    Gender:
    Male
    I was thinking more like Sanitation Officer.
     
  19. irweazel

    irweazel Junior Member

    Joined:
    Dec 31, 2015
    Messages:
    180
    Likes Received:
    26
    Location:
    LA to the bay
    cashier?
     
  20. UltraMysterious

    UltraMysterious Newbie

    Joined:
    Nov 11, 2017
    Messages:
    35
    Likes Received:
    9
    Gender:
    Male
    ISPs don't have cashiers, they're not walk-in public buildings.

    I know how to use a proxy, but I'd rather not need to. Stop being a childish cunt.

    Nope. VoIP engineer and software & web developer.

    I have 'Male' on the right hand side of my screen, how dumb are you?

    Seems even this forum is full of toxic children as well, what did I expect?
     
    Last edited by a moderator: Nov 24, 2017
Thread Status:
Not open for further replies.